CVV Format Specification: Digits and Placement by Network

A CVV format specification defines one thing: how many digits the card security code has and where it sits on the card. Visa, Mastercard, Discover, UnionPay, and JCB use 3 digits on the back. American Express uses 4 digits on the front. The code is issued by the card issuer, printed outside the magnetic stripe and chip data, and it does not appear on receipts or statements.

cvv format validation

How many digits does each card network use for the CVV?

Digit count and position are fixed per network, not per bank. A card from any issuer on that network follows the same layout.

cvv format checking

• Visa (CVV2): 3 digits, back of card, right of the signature panel.
• Mastercard (CVC2): 3 digits, back of card, inside the signature panel area.
• Discover (CID): 3 digits, back of card.
• American Express (CID): 4 digits, front of card, above the account number on the right.
• UnionPay (CVN2): 3 digits, back of card.
• JCB (CAV2): 3 digits, back of card.
• Diners Club (on the Discover network in the US): 3 digits, back of card.

Four-digit codes exist only on American Express in normal consumer issuance. If a checkout form rejects anything but 3 digits, Amex cardholders cannot pay.

cvv format guide

Do CVV, CVV2, CVC, and CID mean the same thing?

They describe the same idea: a verification value that proves the physical card was in hand at the time of the transaction. The names differ because each network trademarks its own label.

• CVV / CVV2: Visa terminology. CVV2 is the printed code; CVV1 is the version encoded in the magnetic stripe and never printed.
• CVC / CVC2: Mastercard terminology.
• CID: American Express and Discover terminology.
• CAV2 / CVN2: JCB and UnionPay terminology.

CVV1 and CVV2 are not interchangeable. CVV1 lives in track data on the stripe, CVV2 is the human-readable code on the card surface.

Where is the code printed on the card?

On American Express it is on the front, above the last digits of the account number on the right edge. On every other major network it is on the back.

Back-of-card placement has one common trap. Many cards print the full 16-digit account number in the signature strip and then add 3 more digits. The CVV is the final group of 3, not the first group. Amex does not repeat the account number on the back, so a 4-digit code on the front is the only one present.

What a CVV is not

• It is not the PIN. The PIN is secret and never printed.
• It is not stored on the magnetic stripe, the EMV chip, or the contactless payload.
• It has no checksum. The Luhn algorithm validates card numbers, not security codes.
• It is not the last 3 digits of the card number, even when those digits happen to sit nearby.
• It cannot be calculated from the card number by anyone outside the issuing bank.

That last point matters for validation logic. A merchant form can check length and numeric content, nothing more. Only the issuer can confirm a code matches the account.

What does PCI DSS say about CVV storage?

PCI DSS classifies the CVV as sensitive authentication data (SAD). Requirement 3.2 prohibits storing SAD after authorization, even in encrypted form.

• No CVV in databases, log files, error traces, or backups.
• No CVV in email, chat transcripts, or support tickets.
• No CVV kept for subscriptions. Use network tokenization or a stored-credential framework instead.
• CVV in transit must sit inside an encrypted channel, per the transmission requirements.

This is why a repeat charge on a saved card asks for the code again. The merchant is not allowed to keep it.

Which form rules follow from the CVV spec?

Field design should match the network layout instead of assuming one size fits all.

1. Set input length to 3 or 4 characters, numeric only, no spaces or dashes.
2. Label the field "security code" and show both placements in a hint (front for Amex, back for others).
3. Switch to a 4-digit field when the card number identifies as Amex.
4. Never prefill the field from stored data, because compliant systems do not hold it.
5. Keep the code out of URL query strings and out of client-side analytics.
6. Mask the input on screen so it does not sit in plain view of a shoulder surfer.

Common format myths

• "A CVV is always 3 digits." False. Amex uses 4.
• "Amex puts the code on the back." False. It is on the front.
• "The CVV rotates per transaction." False. It stays fixed until the card is reissued.
• "A failed CVV check means a stolen card." Not always. Typos and a mistyped billing address produce the same decline.
• "You can verify a CVV offline." False. Only the issuer holds the key used to generate it.

Frequently asked questions

Is a CVV always 3 digits?

No. It is 3 digits on Visa, Mastercard, Discover, UnionPay, JCB, and Diners Club, and 4 digits on American Express. Any form that enforces a fixed 3-digit length will block Amex.

Can a Visa card have a 4-digit CVV?

Under the Visa CVV2 specification, no. The printed code is 3 digits. A 4-digit code on a card that shows a Visa logo points to a misprint, a non-Visa product, or a fake card.

Does the CVV change when a card is renewed?

It can. A renewal with the same account number often keeps the code, while a replacement for a lost or compromised card gets a new one. Cardholders should re-enter the code after any reissue.

Is CVV2 the same as CVV?

Not quite. CVV1 is the value encoded in the magnetic stripe. CVV2 is the 3-digit code printed on the card, used for card-not-present checks. Shoppers and support agents almost always mean CVV2.

Why do some checkouts ask for 4 digits and others for 3?

The field length tracks the network. A well-built form reads the card number prefix, identifies Amex, and expands the security code field to 4 characters.

This guide covers format only. CVV data belongs to the cardholder and the issuing bank, and handling it outside a compliant payment flow breaches card network rules and PCI DSS.